Installation:
1. Activate CKAN virtualenv
2. Clone and install:
git clone https://github.com/DataShades/ckanext-restricted-access.git
cd ckanext-restricted-access
pip install -e .
Add to ckan.plugins:
restricted_access
Configuration:
List of API endpoints to restrict to sysadmins (optional, default: None)
Use * wildcard to restrict all endpoints starting with prefix
ckan.restricted.api_actions = harvest_* user_autocomplete status_show
List of UI paths to restrict (optional, default: None)
Use regex for complex rules
ckan.restricted.ui_paths = ^/user/default$ (?!.login)/user/
Error code for restricted paths (optional, default: 404)
Also impacts error message content
ckan.restricted.ui_paths.error_code = 403
Custom error message for restricted paths (optional)
Default: CKAN core message for error code
ckan.restricted.ui_paths.error_message = Not authorized to see this page
Redirect anonymous users to login page (optional, default: false)
ckan.restricted.redirect_anon_to_login = true
Example Use Case:
- Public CKAN instance harvests from private instance
- Harvest source contains API key of private instance user
- harvest_source_list API action exposes full config including API key
- Security risk: need to restrict harvest_source_list to sysadmins
- Solution: ckan.restricted.api_actions = harvest_*
Access Control:
- Only sysadmins can access restricted endpoints
- Provide api_token of sysadmin to get access
- Anonymous users can be redirected to login
- Custom error codes/messages for better UX
API Wildcards:
- harvest_* restricts all actions starting with ‘harvest_’
- user_* restricts all user-related actions
- * alone would restrict everything (not recommended)
UI Path Regex Examples:
- ^/user/default$ - exact match for /user/default
- (?!.login)/user/ - all /user/* except those containing ‘login’
- ^/admin/.* - all admin paths
- ^/(harvest|user|admin)/.* - multiple sections
Benefits:
- No need to override every action/auth function
- Centralized restriction management
- Middleware-level security
- Flexible wildcard and regex support
- Protects sensitive API configurations